0

I would like to configure spam filtering with exim's built-in spam filter support in acl_check_data config section.

The piping, exim header modification (to store result) works well. As well as transporting the mail to Junk folder by dovecot-lda.

My only problem is that I can't pass the virtual user of recipient to spamassassin to let spamd load the user's preferences from sql.

I know, the left side of exim's "spam" keyword is for that, but it does not pass any variable for me. Only static values: simply ignores all variable I set.

Here is my config section:

acl_check_data:

  # Deny if the message contains a virus. Before enabling this check, you
  # must install a virus scanner and set the av_scanner option above.
  #
  deny    malware    = *
          message    = This message contains a virus ($malware_name).

  # Add headers to a message if it is judged to be spam. Before enabling this,
  # you must install SpamAssassin. You may also need to set the spamd_address
  # option above.
  # {def:h_Envelope-to:}

        # Accept when mail size is over 500k
  accept  condition = ${if >={$message_size}{500k}{yes}{no}}

  # put headers in all messages (no matter if spam or not)
  warn    spam       = ${local_part}@${domain}:true
          add_header = X-Spam-Score: $spam_score\n\
                       X-Spam-Score-Int: $spam_score_int\n\
                       X-Spam-Level: $spam_bar\n\
                       X-Spam-Report: $spam_report

  # add second subject line with *SPAM* marker when message
  # is over threshold
  warn    message    = Classified as spam.
          spam       = ${local_part}@${domain}
          add_header = X-Spam-Flag: YES\n\
                       Subject: [SPAM] $h_Subject:

  # reject spam at high scores (> 12)
  deny    message    = This message scored $spam_score spam points.
          spam       = ${local_part}@${domain}:true
          condition  = ${if >{$spam_score_int}{120}{true}{false}}

  # Accept the message.

  accept

The current form is "${local_part}@${domain}", but I tried more: ${local_part@$domain}, with quotes, without brackets, etc. Only the at sign (@) passed, while variables works at other keywords (conditions for example).

I know, I can make a (resource hungry) transport hook or even filter by dovecot, however I would like to use this feature if possible. So please don't advise other solutions, I know them.

1

What you want to do is simply not possible. Checking for spam at SMTP time forbid this as you would end up at somme point scanning one mail (so one single scan) which will contain multiple recipients... Which user preferences would you load then? In order to do this you need to use a pipe transport (to spamc) at delivery time, not at SMTP time. In any case, using heavy spam detection (like spamassassin) at SMTP time is a bad idea as it makes your server prone to DoS attacks. Use lighter spam detection at SMTP time and heavy one (with rules that fit each user) at delivery time.

| improve this answer | |
  • BTW, I wrote this few years ago. It is probably a bit outdated now, but I believe it may still help: howtoforge.com/… – alxgomz Oct 1 '14 at 19:14
  • Scanning at SMTP time is no more CPU intensive than scanning at delivery time if you always scan. However, if you want per recipient the scanning must be done at delivery time. Spamd can be configured to use virtual configuration so should not be a significantly heavier load than scanning at SMTP time. – BillThor Oct 2 '14 at 1:08
  • Yes and no, of course scanning is scanning and has to be done at some point. But doing it at smtp time will make SMTP sessions a lot longer thus making it very easy to starve from connections/memory... Doing the same scan at delivery time makes it possible to rely on earlier lightweight spam detection (possibly at smtp time) to drop spam before it even reach the delivery agent, saving resources on both the smtp and the delivery host. – alxgomz Oct 2 '14 at 6:12
  • @axgomz I use delays starting at connect time for hosts failing reverse DNS validation, or listed in selected blacklists. Very little spam actually makes it to the DATA stage. – BillThor Oct 3 '14 at 12:55
  • @BillThor if your hosts doesn't handle big mail traffic that's probably more acceptable. However remember that you are not only scanning spam emails but ham as well. No matter how much spam is stopped, the pb lies in the fact to use heavy scan at SMTP time. Why do you want to do that? I guess because you want to fast reject mails. That's a good reason, but only only if you're 100% sure you have to reject that mail, and with spam detection engines you're never sure. At least rbl, greylisting and similar have a predictable behaviour. – alxgomz Oct 4 '14 at 13:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.